Backup your SPI flash memory on SD card (Wm8505 – Wm8650 tablets)

The most important thing to do before attempting to change / upgrade / modify the default firmware for a tablet (we speak about the WM8505 / WM8650 models), is to create a backup of the internal SPI flash memory. The internal SPI flash memory is the hearth of a tablet. If you can rewrite it with original contents, you can always restore your tablet to the original state.

I highly recommend, for anyone wants to play this “game” with his own tablet, to build a serial interface, that is a basic, but powerful, instrument to “look” inside a tablet. There are many interfaces available to convert the 3.3V signals, present in the tablet, to RS232 levels, and other cheap circuits that directly connect 3.3V true logic from the tablet to USB port, that is seen as COM port from a PC. I suggest to use my own design circuit proposed on my page at this link, ‘cause is powered by the tablet itself, so it doesn’t introduce any voltage in the device input lines when the device itself isn’t powered on. I have had problems, with direct USB to TTL interfaces, due to the presence of positive voltages on transmitting side of the interface even if the tablet was off. So, please, build my circuit (it works !), or use one similar…

In the oldest tablet I own, the Evodroid Devo, based on WM8505 processor, there isn’t any “dongle” for the USB / LAN / Serial. There is just a mini plug for USB, but the serial port is always present inside the tablet. So, opening the case, you can solder the 4 wires needed for a serial terminal connection on the 4 pads as in the picture below :

The TXD is intended as tablet TXD, so is the output from tablet, while RXD is obviously, the data input to tablet.

Using a terminal emulator and the RS232 interface, we can make huge amount of tests and experiments. I recently updated my PC serial terminal program for some problems encountered on WM8505 tablets. In the new version, available for download at this link , I added the sequence “+++” ; if you quickly type this sequence on your PC keyboard, the terminal sends a Ctrl-C plus a CR to the tablet, stopping the autoboot (as default, U-Boot automatically starts the Linux Kernel and Android OS that are stored on tablet’s mass storage NAND flash).

Note that, for storing a copy of the internal SPI flash memory, you must insert a FAT32 freshly formatted microSD card in the tablet’s slot !

Well, if you have the serial interface connected to your PC, launch the terminal program, then turn on the tablet. You will see the W-load and the U-Boot messages ; immediatly type on the PC the +++ sequence (or type Ctrl-C and Enter if using another terminal program)… After a while the U-Boot will stop writing the command prompt WMT # ; the autoboot has been stopped and you can execute commands from the U-Boot provided set. Note that the U-Boot versions are different from one tablet model to another, but many commands are always available, even with small syntax differences. Here, I will describe the backups done from a relatively new 9.7″ tablet based on WM8650 processor, and from old 7″ Evodroid tablet (the one shown in the picture).

The first command to enter is the MMC initialization (MMC is the default name for the SD card), so we must type :

mmcinit 0

 (0 selects the first SD card in wm8650 tablet, that has 2 SD cards capability)

or simply :


 (in wm8505 that has only one SD card available)

We receive some messages from the tablet ; if all is OK, the MMC (SD) has been initialized and is ready to operate. Remember to use a FAT32 formatted one !

Now, we type the command :

cp.b FFF80000 0 80000

that means : copy bytes from address FFF80000 (the start of SPI flash memory) to address 0 (the start of RAM) for a length of 80000 bytes (that is hexadecimal, as all the data supplied), so 80000 is 8 * 64K = 512K bytes, the size of the whole SPI flash.

This operation will take a couple of seconds… then we have a copy of the whole SPI flash stored in system RAM. Now, we can use the powerful command “fatstore” to save that area to a binary file on the SD card :

fatstore mmc 0:1 0 backup.bin 80000

This command means : store a file on FAT system device mmc (our SD card), on partition 0:1 (the card is freshly formatted, so has just one partition : card 0, partition 1), reading data from RAM address 0, to a file named backup.bin, for a length of 80000 (hexadecimal) bytes. Note that in the wm8650 tablet I havent had any problem to execute this command, but in WM8505 there was something wrong while writing the SD card. The solution, was (simply) to substitute the original 4GB SD card previously used, with another one, a little bit older, sized just 128 MBytes ! That card was VERY OLD, it was in my LG cellphone by many years. So, if you have errors, try with another SD card, freshly formatted, of different type, brand or size.

When this operation terminates with success, you have a copy of your SPI flash stored on the SD card. This 512KBytes file has the U-Boot.bin, the Env_uboot.bin and the W-Load.bin files all in one. You can expand in 3 different files using my software tool that can be downloaded from this link. The zip file contains just one executable written in FreeBasic ; it does not require installation ; just deflate it in a new directory and copy in the same folder the spi.bin file you want to split ; at end of the process you will have u-boot.bin, w-load.bin and env_uboot files in the same folder.

Obviously, you can simply use the full file spi.bin file with an SPI programmer in case of tablet “hard bricked”.

To turn off the tablet, type the command :


or, if it isn’t recognized, simply press and hold the power button. Extract the SD card and read the contents with your PC. If you want, send the BIN file to my blog, using the file transfer form ; I will collect the different roms for future help requests… 🙂

Double the size of LocalDisk on Evodroid tablet (WM8505)

Hello, I purchased an old, used, working tablet based on obsolete processor WM8505. Why an obsolete model ? The reason is very simple : there is, on the internet, a full datasheet of the processor and good documentation, in general. When new products reach the market, they are still very technical, so well documented and simple to use. When it goes to be a business, the “commercials” come in and say to technicians : “you must hide all the infos and introduce some strange key to make impossible for anyone to look inside”. This is ‘cause the “commercials” are not able to produce ideas, they are able just to speak about things they can’t understand, and always have blinded vision of the future. Someone, any time, breaks the locks and looks inside,  ‘cause the “perfect lock” doesn’t exists. The result of this stupid behaviour is that the mankind is slowered and uses 20 years to reach the results that can be achieved in two. But the “commercials” are so happy, they sell and make big business. Absolutely haven’t a long view into the future.

Ok, I opened my tablet, just for look what’s inside. Here is a picture :

Just in the middle, you can see the “coreboard”, the hearth of the system, with the processor, the SPI flash with boot program, the ram, the oscillators and … the NAND FLASH ?  I can’t see the NAND flash, the “hard disk” of my tablet. Where is the NAND flash ?

ooooh, I found it, Is on a small board, hidden under the main board. But… there are only four wires ! Naaah, the NAND flash is a very common USB memory key ! That’s incredible, so the boot program in SPI flash is able to launch the system from an USB memory… VERY interesting !

I decided to disconnect the module from the tablet and wire it to a standard USB plug, in order to analyze it with my PC.

So, now I have an USB memory key with the hard disk of my tablet… Immediatly put in my PC and use the program Win32 Disk Imager, it’s open source, it’s simple, it works very well. I create a copy (img) of full pendrive and saved to disk for cloning on another USB memory key. Obviously, for using a standard usb memory key, I mounted a female usb plug in the tablet, using the 4 wires where was attached the original board. I used a 4GB memory key as destination of image file and tried to restart my tablet with such pendrive…

Ok, wires are connected, try to boot the tablet :

Uhmmm, animation starts, but continues “ad libitum” without starting the Android OS. There must be something wrong. Now, I extracted my pendrive and put it in another PC, running Puppy Linux. This is for a simple reason, Puppy Linux is my favourite “distro” and has the great GParted program, a powerful application to “look” inside disks and partitions. Inserting the pendrive, I discovered that has MANY partitions inside !

I see the main partition (the start) hasn’t the ‘boot’ flag. May be that’s the reason for tablet not starting ? Mmhh, let’s try to check. Modified the flags adding the ‘bootable’ to the first partition, then extracted the pendrive and tried again on the tablet…

WOW, now it works ! Ok, now, coming back to the Puppy Linux, I looked at all the partitions and the contents. First, the partitions list:

and now, the contents of each one : first SDB1

then, SDB5

then, SDB6

then, SDB7

and, finally, the SDB8

This is our “localDisk” ! Now, the original NAND flash was 2 GB and I have the new one that is 4GB, so i will resize the partition, using the GParted going from this situation :

to this new organization, filling all available space :

OK, all done. Now back again to the tablet and reboot. The led lights, the system starts…

And now, let’s go to measure how big is our LocalDisk 🙂

Wow… very good. Now, I can’t have an USB memory key attached to my tablet, so I opened the pendrive’s case and discovered that the small board inside is VERY similar to the original one…

So, I desoldered the USB plug and soldered the new circuit in place of the old one. All worked perfectly, tablet closed, disk space doubled.


Very simple wifi enhancement for tablet

Hello, my tablet has so many moddings… but when far from the router it has some difficulties to connect to the internet. So I soldered a 32 mm long enamelled wire at the base of printed CS antenna. The gain was more than aspected. Now I can connect from places where it wasn’t possible before.
Obviously, the enamelled wire must be “scratched” in the point where it’s soldered to the circuit. In this picture below you can see my version of this very basic antenna…
P.S. to the R.F. gurus : I know that this is NOT a clean way, but it works…

My camera works with one AA LiFePO4 cell

Hello, I own an old but efficient HP photosmart 447 camera. Normally, it works with 2 standard AA 1.5V cells. I love my camera, but has a defect : the batteries are discharged even if the camera is OFF. Ok, my first thought was to use 2 standard rechargeable AA Ni-Mh cells, but there is a problem… that cells are 1.2V, not 1.5V as the alkaline, and the camera works just for some minutes and after that shows the “purple screen of death” with the message “battery level insufficient to take a picture”. Ok I searched for 1.5V rechargeable cells. I found the new LiFePO4 batteries, widely used in the electrical byke and cars, and solar generators. Such batteries have many advantages and are quickly going to “invade” the market even for different applications. One single cell is rated for 3.2V Wow… I found one AA size, with 1000mA capacitance. Note that, as other Lithium based batteries, the nominal capacitance is NOT the maximum you can ask from your device. You can drain over TEN TIMES that capacitance, so if my camera needs (while the motor runs to put in or out the lens) for 2000 mA for a couple of seconds, the battery can supply it without any problem.

Now, the battery is 3.2V and my camera works (normally) with 2 batteries 1.5V, so a total of 3V. Any electronic device can accept a 10% overvoltage ! Now the problem is that the single AA battery is 3.2V, but in the camera we have place for 2 batteries… so I created a fake 0V battery using these materials :

Assembling the parts I had this result :

So, this is my 0V battery that placed in the camera together with the other AA LiFePO4 cell rated for 3.2V gives a total of… 3.2V :

Turned on the camera… ALL RIGHT. It works. Now I need for a charger for my new battery. I realized one in few minutes. This is a very basic one.. look at the schematic :


This circuit HASN’T any control, YOU are the controller. Measuring the voltage on the battery under charge, you MUST disconnect the charger when you read, with a voltmeter the voltage of 3.60V . Remember… YOU ARE THE CONTROLLER ! Here is a picture of the working circuit :

This is a slow charging circuit. You can find much more efficient and automatic controlled, but this is simple and can be built with real basic components. Consider that slow charging mantains the life of the battery for longer time. The LiFePO4 batteries have a typical life of 2000 (two thousands !) charges losing just the 10% of the capacitance. That’s incredible.

LAN connection without dongle on WM8650 tablet

When using a LAN connection with a tablet that hasn’t the RJ connector on-board, you can have some problem to gain the Heaven, ‘cause very often the “dongle” with the attached LAN cable detaches from the tablet, breaking all the connections (and probably your active work) and you, in such situation, may automatically start a sequence of @#@#@# and @@#@#@ that are not good to make points to your future “seat” up into the Sky.

So, what’s the simplest way to add an RJ connector to a tablet that hasn’t one ? It’s very simple : open the tablet and look for the transformer. Every tablet I’ve seen has all the circuitry inside, just the connector is outside, on the dongle. The transformer is the better place to solder wires, ‘cause has (usually) the pins spaced of 1.27 mm that is a measure easy to solder. In this picture, you can see one model of these transformers :

Even if your model is different, you will always have four small wires (look at the red arrows in the image) that comes from the “black bug” and go to the dongle’s socket. In my tablet’s specific case, the pins are named this way :

  • pin 16  RX + goes to RJ45 connector pin 6
  • pin 15  RX – goes to RJ45 connector pin 3
  • pin 10  TX + goes to RJ45 connector pin 8
  • pin  9   TX – goes to RJ45 connector pin 7

To clarify what are the positions of the pins on the RJ female connector / socket, here is a picture of the one that’s normally placed on the tablet’s dongle : note that the pin 1 is at the left ; the pinout suggested in the list above uses this standard.

Note that the pairs RX and TX are always “physically separated” (it’s a transformer !), so if in doubt when connecting a different type, consider that the TX and RX pairs are : one on a side, the other on the opposite. Also note that all the components on the circuit, needed for a correct ESD protection, are not mounted. It’s for sparing some money. In the practical use, if you just connect the tablet to a 1 meter cable tied to a router or another PC, you don’t need for it. Remember : you’re playing with very cheap devices. Anyway… soldering isn’t difficult, look here how I connected 4 wires of typical flat cable :

Not too difficult… and now, on the other side, I connected the RJ45 socket that will be used as tablet’s LAN connector. After testing the connection with success, use something like hot glue to make it “solid” and electrically insulated.

And finally, using a normal 1,5 meters LAN cable, I connected the tablet at my router and gained access to Google, as you can see in this final picture (note that wifi isn’t enabled !)

If you look a little bit deeply, you can see also other 2 cables coming out from the tablet… One is the serial port that actually is connected to IR led to work as remote control for my Sony TV, and the other is an USB female port, active and working (but unconnected in this picture), that I often use for my wireless KB / Mouse. Obviously… I hate tablet dongles 🙂


WM8650 tablet as remote control for Sony TV

Hello, here I am, again, with a simple mod for our tablets. In this picture you can see how it’s possible to control a TV set with our tablet using just one resistor and one IR Led ! In the picture you can see the tablet “dongle” (free of the plastic case) with the additional components needed. The circuit is the same proposed at point 3. of my article at this link (in Italian), just the led “color” is IR and the resistor is of lower value to gain some additional emitting “power”.

The IR led anode is directly connected to the 3.3V pad and the cathode to the resistor and this to the TXD pad ; the resistor value is 220 Ohm and must not be decreased in value.

Obviously, the distance you can reach with this small interface is very low, about 20 cm, but I will add in next days a driver circuit to make it working at longer distance. This is just a “proof of concept” (I like this definition).
At this link you can find the zipped APK file (the application) that I’ve written to test the device. Starting the application, you can see 12 buttons keyboard for entering the code to be transmitted, one “display” that shows what you type, and 2 other buttons: one is named “SEND” and simply transmits the IR code while you hold it down, and the other is named “QUIT”, to exit the application.

The program is compiled in debug mode, so without keys or locks. Deflate it from the downloaded zip and copy to sdcard of your tablet, then install it. Obviously, you must have the “unknown source” flag active.

The default command is 21 that in my Sony Bravia TV is the power-on / Power-off ; also test the numbers from 0 to 8 that are for changing channel from 1 to 9 ; for other commands, search on the internet for the Sony IR protocol.

Note: the program needs a small modification in init.rc file (you must be able to do this or the program will open with an exception error). In the init.rc command you MUST disable the console service.

this is the original:

## Daemon processes to be run by init.
#service console /bin/sh
service console /bin/login

you must change it to :

## Daemon processes to be run by init.
#service console /bin/sh
#service console /bin/login
#    console

Obviously, this is a first try… so if there are errors, please, don’t shot me ! But give me your feedbacks and suggestions to improve it. Thanks

Tablet bloccato : e adesso ?

1. Come tutto è cominciato…
Nella colonna a destra (links utili) potete vedere il link al sito che ha dato l’avvio alla mia sperimentazione sui tablets Android (HcH / TechKnow), nella fattispecie su quelli basati su processore WM8650 (WonderMedia), prodotti generalmente in Cina. Costano così poco (tipicamente un sesto di quelli con la meletta) che si è invogliati a sperimentare. Sperimentando sperimentando, però, si arriva spesso a una situazione in cui il tablet non si accende più !
E allora… inizia il pellegrinaggio informatico sui vari siti internet dove si trovano le soluzioni e i trucchi. Molti di questi siti sono in lingua inglese e talvolta i “noobies” (novellini) vengono trascurati (detto più esplicitamente, non se li fila nessuno). Ho ricevuto diverse richieste di “AIUTO !” dal form dei messaggi del mio blog, così ho deciso di aggiungere un articolo specifico su questo argomento : far rivivere un tablet “bricked”,  come dicono gli anglofoni (sbroccato, come diciamo noi).

2. Il reset
Il primo momento di panico e la prima sensazione di aver preso una fregatura, ci arrivano dopo un paio di giorni dall’acquisto del tablet. Questo, infatti, non si accende più. Come funziona il tablet ? Ha tre stati possibili: “acceso”, “spento” e “in sospensione”. Quando accendiamo per la prima volta il nostro tablet low-cost, vediamo il famoso robottino verde che si anima, poi la scritta “Android” che si illumina e infine appare il desktop con le varie applicazioni disponibili.
Il tablet è acceso e operativo. Ora, quando premiamo brevemente il pulsante di on/off, lo schermo si spegne e il tablet va “in sospensione”; in questo stato dovrebbe consumare quasi nulla e sarà in grado di riprendere immediatamente ad operare quando premeremo, di nuovo, brevemente il pulsante on/off. La ripresa delle operazioni è segnalata con la richiesta di strisciare un dito sul touch-screen con modalità diverse da tablet a tablet.
Una volta fatta la “strisciata”, il tablet torna al programma che stavamo eseguendo prima di andare “in sospensione”. Se premiamo il tasto di on/off a lungo, ci viene fornito un menù di scelte, tra le quali lo spegnimento totale. Quest’ultimo, inoltre, si ottiene anche continuando a tenere premuto il pulsante di on/off. Lo spegnimento totale implica che alla prossima accensione dovremo sorbirci ancora il robottino, la scritta e tutto il tempo necessario al caricamento del sistema operativo.
Nella mia esperienza pratica su tre diversi tablet, ho potuto appurare che la fase di “sospensione” consuma la batteria in modo considerevole. Cosa succede, quindi ? Succede che se avete lasciato il tablet in questa condizione e lo riprendete dopo un giorno  o due, non si riaccende più, perché la batteria è scarica. Allora pensate di collegare
l’alimentatore e ricaricare la batteria, convinti che, appena si sarà caricata, tutto funzionerà di nuovo. Bene, non è così. Il tablet, anche con la batteria completamente ricaricata, continuerà a non accendersi.
E allora… via, su internet a chiedere consiglio, aiuto, a scrivere frasi disperate: “il mio tablet si è rotto !” e la sensazione di cui parlavo all’inizio, quella di aver preso una fregatura. Calma, il rimedio c’è e si trova in un minuscolo e praticamente invisibile forellino, posto sul lato inferiore del tablet (non in tutti è nello stesso posto, bisogna cercare). Questo forellino, che in qualche caso ha una scritta “reset” e in altri ASSOLUTAMENTE NIENTE, consente di premere un pulsantino interno che provoca, per l’appunto, il reset del tablet permettendo, con la pressione del pulsante on/off, la ripartenza del sistema operativo (da zero, robottino e resto). A me, tutto ciò che ho descritto, è successo sul serio e non potete immaginare il sospiro di sollievo che ho fatto quando il tablet è ripartito. Ho avuto modo, successivamente, di creare danni molto più consistenti, ma questo sarà oggetto di successive pubblicazioni 🙂
Nota: il pulsantino di reset è interno di qualche millimetro, per cui bisogna “cercare” con l’attrezzino (la clip per documenti aperta) per trovarlo. Si deve sentire il “click” per ottenere il reset. Su alcuni tablet è più facile perché c’è un supportino di plastica che riempie la distanza tra il bordo di plastica e il tastino, ma in altri no e bisogna cercare con attenzione e cautela. Operazioni brusche e violente possono far mancare il pulsantino e magari danneggiare componenti elettronici che si trovano sul circuito vicino ad esso ; calma, quindi.
Nella foto sotto potete vedere dove si trova, tipicamente, il forellino (cliccate sull’anteprima per ingrandire).

3. La porta seriale
Per arrivare a qualche risultato, per prima cosa bisogna dotarsi di un minimo di attrezzi hardware e software. Cominciamo con un “pezzo facile”, colleghiamo un LED alla scatolina di espansione del tablet. La scatolina, quando è chiusa, mostra due connettori USB e un RJ45 per la LAN. Aprendo la scatoletta, svitando quattro viti, viene fuori il circuito che… SORPRESA… ha anche 4 fori a passo 2.54mm con i segnali della porta seriale “ttyS0” del sistema operativo Linux che sta alla base di Android.
Per prima cosa, suggerisco di saldare un connettore strip (non ha a che vedere con gli spogliarelli) per poter poi collegare eventuali interfacce seriali.
Il più semplice dispositivo che possiamo collegare per vedere se il nostro tablet esegue ancora qualche operazione al “boot” è costituito da un normalissimo LED (questo nella foto è verde, ma va bene anche giallo o rosso) e da una resistenza. Ecco un esempio costruttivo: (cliccate sull’anteprima per l’immagine ingrandita)

Quando questo circuito è collegato e si accende il tablet (power on), si vede il LED illuminarsi e tremolare. Significa che il sistema Linux sta inviando al terminale (che potrebbe essere connesso) tutto l’elenco delle proprie attività. Quando il sistema è completamente avviato (e voi vedete il bello schermo di Android), l’attività sul LED sarà visibile solo con un rapido “blip” una volta ogni 60 secondi. Questo perché Linux, una volta al minuto, esegue una uscita seriale per invitare un eventuale utente collegato su terminale ad effettuare il login. Quindi, la prima prova da fare su un tablet “bloccato” è quella di collegare questa interfaccia e vedere come si comporta il LED.

4. Il terminale
Se la “prova del LED” è stata superata, quindi siamo sicuri che il nostro tablet mandi fuori dei caratteri dalla porta seriale, possiamo andare avanti e cercare di interagire con esso tramite un “terminale” seriale RS232.
Ci servono due cose: un software e un hardware. Per il software, sia in ambiente Windows che in Linux, c’è l’imbarazzo della scelta: fino a XP, il terminale seriale era di serie (scusate il gioco di parole) su Windows; da Win7 è stato eliminato (con accuratezza la M$ toglie i programmi più utili ad ogni nuova versione) e bisogna reperirlo altrove. Io, di solito, uso RealTerm su Win XP e CuteCom su Linux (sono un fanatico di Puppy Linux). Se volete un miniterminale essenziale, ma comunque funzionante, potete utilizzare quello scritto da me (si chiama miterm-en). Lo potete scaricare da questo link . Il programma è stato scritto con FreeBASIC e compilato per Windows e gira tranquillamente su Win7. Non c’è bisogno di installazione: semplicemente prendete il file ZIP, estraete il file eseguibile EXE e lo cliccate. Il programma parte “di default” con la porta seriale COM4. Se la vostra porta seriale (o interfaccia usb-rs232) ha un numero diverso, il programma darà errore e vi chiederà di inserire un’altra porta oppure di dare il “return” senza scrivere nulla, per uscire. Nell’immagine sottostante potete vedere la schermata d’inizio sul mio PC. L’interfaccia usb-rs232 che utilizzo, installa sul sistema la porta COM19 e infatti scrivo com19 quando il programma si inizializza e mi comunica di non poter usare la porta di default COM4.

L’altra cosa che ci serve è l’interfaccia hardware. Abbiamo parlato finora di convertitori
usb-rs232, ma la porta seriale del tablet è a livello TTL (segnali SOLO POSITIVI di ampiezza 3.3 Volts) e quindi NON POSSIAMO collegare direttamente i segnali di TXD e  RXD della DB9, in quanto questi hanno livelli diversi (positivi E NEGATIVI e con logica inversa), ma dobbiamo convertirli con un apposito circuito. Io ne ho realizzato una versione personale, usando un integrato smd tipo MAX-3232 (oppure ST-3232, più economico) e disegnando un circuito stampato idoneo. Tutto il materiale (schema elettrico e disegno PDF in scala 1:1 per la fotoincisione del circuito stampato) è disponibile per il download a questo link .

Esistono, ovviamente, anche prodotti commerciali che fanno le stesse cose. Dietro segnalazione di un amico (arrivata DOPO che avevo costruito il tutto…) ho acquistato su ebay una interfaccia usb-seriale TTL, ad un costo irrisorio (meno di 3 Euro, spedizione compresa).

Purtroppo, però, il produttore è in Estremo Oriente ed i tempi di consegna sono dell’ordine di tre settimane. Se utilizzerete questa interfaccia usb-seriale TTL, dovrete collegare solo i tre fili GND, TXD, RXD direttamente dall’interfaccia PC a quella del tablet. Collegamento DIRETTO, quindi GND con GND, TXD con TXD e RXD con RXD, contrariamente a quello che dovete fare se usate la mia interfaccia nella quale è necessario collegare ANCHE il 3.3 Volt e i segnali RXD e TXD sono incrociati. Aggiungo una nota che può essere utile : con l’interfaccia “cinese” e in genere con tutte le interfacce usb-rs232, può essere necessario intervenire sul setup della porta seriale per disattivare il buffer FIFO, in modo da eliminare latenze e ritardi introdotti dal driver. Il circuito descritto, se lo acquisterete, vi arriverà senza disco di driver, perché è basato sul chip CP2102 della Silicon Labs che viene riconosciuto immediatamente dal sistema.
Se sul vostro PC le cose dovessero andare diversamente, cercate il sito della Silicon Labs e scaricate da lì il driver aggiornato per CP210x per il vostro sistema operativo.

5. Caccia allo U-Boot
Bene, abbiamo costruito (o comperato) l’interfaccia, abbiamo installato il programma per il terminale e siamo pronti per vedere cosa trasmette il nostro tablet. Avviamo il programma sul PC e accendiamo il tablet…
Ecco subito arrivare i primi messaggi:

WonderMedia Technologies, Inc.
W-Load Version :
wloader finish

Questo ci dice che il nostro tablet è basato su un processore WonderMedia, tipicamente il WM8650 o, se più vecchio, il WM8505. La fase di W-load è andata a buon fine e quindi viene avviato lo U-Boot. Ecco come proseguono i messaggi :

U-Boot 1.1.4 (May 12 2011 - 15:34:56)
WonderMedia Technologies, Inc.
U-Boot Version : UPDATEID_0.
U-Boot code: 03F80000 -> 03FC2A30 BSS: -> 03FCCC4C
boot from spi flash.
SF0: ManufID = 20, DeviceID = 2013 (Missing or Unknown FLASH)
Use Default - Total size = 8MB, Sector size = 64KB
SF1: ManufID = 0, DeviceID = 0 (Missing or Unknown FLASH)
Use Default - Total size = 8MB, Sector size = 64KB
Bank1: FF800000 -- FFFFFFFF
Bank2: FF000000 -- FF7FFFFF
Flash: 16 MB
sfboot NAND:env nand config fail, use default flash id list info
pllb=0xc30, spec_clk=0x190a0fff
T1=3, clk1=16, div1=7, Thold=1, tREA=25+delay(9)
T2=2, clk2=18, div2=8, Thold2=1, comp=1
Tim1=524288 , Tim2=442368
T2=1, clk2=34, div2=15, Thold2=1, comp=1
Tim1=442368 , Tim2=557056
T2 is greater and not use
T=2, clk=18, divisor=8, Thold=0x601
divisor is set 0x8, NFC_timing=0x2424
1 Nand flash found.

Nand Flash Size: 2048 MB

In: serial
Out: serial
Err: serial
### main_loop entered: bootdelay=1

Ed ecco il punto che mi ha fatto IMPAZZIRE. Nell’ultima riga vedete il commento che avvisa che si è entrati nella fase principale e si vede che il bootdelay è uguale a 1. Questo significa che il programma, prima di partire con il caricamento di tutto il resto, DOVREBBE aspettare 1 secondo per consentire ad un eventuale utente collegato sul terminale seriale di fermare tutto ed entrare nella fase comandi di U-Boot, fase nella quale è possibile effettuare modifiche utili per correggere eventuali problemi. Ho scritto DOVREBBE perché invece non è così. La versione di U-Boot che mi ha fatto sudare 7 camicie NON si ferma, qualsiasi carattere si invii da terminale, né ctrl-c, né spazio, né altro. Ho addirittura scritto un programmino che inviava una tripletta di caratteri “idonei” immediatamente dopo aver ricevuto la scritta “main_loop entered”, pensando che forse io ero troppo lento (sono solo un essere umano) ad inviare i caratteri in quel secondo di tempo concessomi. Beh, non era così. Semplicemente questa particolare versione di U-Boot non si ferma -E BASTA- . Se siete in questa situazione, non potete fermare lo U-Boot e quindi non potete effettuare modifiche. Il programma prosegue e ci invia altri messaggi :

logocmd="nandrw r ${wmt.nfc.mtd.u-boot-logo} ${wmt.display.logoaddr} 10000; nandrw r ${wmt.nfc.mtd.u-boot-logo2} ${wmt.display.logoaddr2} 40000; nandrw r ${wmt.nfc.mtd.kernel-logo} ${wmt.kernel.animation.addr} 80000; display init force; decompanima -f ${wmt.display.logoaddr2} 0x3000000; decompanima -f ${wmt.display.logoaddr} 0x3000000"
Load Image From NAND Flash
col=0x2150, row = 0x3ff80
block2047 tag=42627430 version =1
col=0x2150, row = 0x3ff00
block2046 tag=31746242 version =1
bbt table is found
Too Many Error
Too Many Error
Too Many Error
Err1 at 11080
Load Image From NAND Flash
Too Many Error
Too Many Error
Err1 at 11100
Load Image From NAND Flash
Too Many Error
Too Many Error
Err1 at 11280
[VOUT] ext dev : LCD
[VOUT] int dev : NO
[LCD] wmt default lcd (id 4,bpp 24)
vpp_config(800x480@60),pixclock 40000000
div_addr_offs=0x35c PLL_NO=1
[VPP] get base clock PLLC : 400000000
1div_addr_offs=0x374 PLL_NO=2
find the equal valuePLLN64, PLLD5, PLLP2, divisor2 freq=40000000Hz
PLL0x5440, pll addr =0xd8130208
PLLN64, PLLD5, PLLP2, div2 div_addr_offs=0x374
read divisor=2, pll=0x5440 from register
[GOVRH] set clock 40000000 ==> 40000000
div_addr_offs=0x374 PLL_NO=2
[VPP] get base clock PLLB : 40000000

E qui il mio tablet si bloccava, perché (come si nota dai numerosi errori listati) avevo modificato con un editor esadecimale i dati del logo (il robottino verde) creando un errore grave. Se il programma di U-Boot si blocca PRIMA della verifica dei dati nella SD card esterna, non può evidentemente effettuare il caricamento di una nuova versione di ROM, e quindi tutto rimane fermo. Schermo nero, nessuna successiva attività. In questa situazione tremenda, non avendo trovato altre soluzioni da software, ho deciso di aprire il tablet, dissaldare la memoria SPI, riprogrammarla con una coppia W-Load ed U-Boot “fresca” (e con il bootdelay messo a 3 secondi, così ho tutto il tempo per fermarlo !!!) e quindi saldare nuovamente il chip sul circuito stampato. Purtroppo ho rovinato due “pads” ed ho dovuto fare una certosina operazione di recupero. Trovate tutta la descrizione sul mio articolo a questo link . La descrizione è in inglese perché originariamente l’ho scritta per segnalarla sul forum HcH / TK che è stato la mia fonte principale di apprendimento. Con il nuovo U-Boot, finalmente, ho ricevuto il messaggio che dice di premere un tasto
qualsiasi per entrare in modalità comandi. Ho premuto un tasto e FINALMENTE sono entrato in modalità comandi ! Ho premuto il carattere ‘?’ che di solito avvia la lista dei comandi (help) ed ecco cosa ho ricevuto :

WMT # ?
?       - alias for 'help'
autoscr - run script from memory
base    - print or set address offset
bdinfo  - print Board Info structure
boot    - boot default, i.e., run 'bootcmd'
bootd   - boot default, i.e., run 'bootcmd'
bootm   - boot application image from memory
bootp\0x09- boot image via network using BootP/TFTP protocol
cmp     - memory compare
coninfo - print console devices and information
cp      - memory copy
crc32   - checksum calculation
dhcp\0x09- invoke DHCP client to obtain IP/boot params
diskboot- boot from IDE device
show    -
echo    - echo args to console
erase   - erase FLASH memory
exit    - exit script
fatinfo - print information about filesystem
fatload - load binary file from a dos filesystem
fatls   - list files in a directory (default /)
fatstore - store binary file to a dos filesystem
flinfo  - print FLASH memory information
go      - start application at address 'addr'
help    - print online help
icrc32  - checksum calculation
ide     - IDE sub-system
iloop   - infinite loop on address range
imd     - i2c memory display
iminfo  - print header information for application image
imls    - list all images found in flash
imm     - i2c memory modify (auto-incrementing)
ims  - set i2c device context from memory
imw     - memory write (fill)
inm     - memory modify (constant address)
iprobe  - probe to discover valid I2C chip addresses
itest\0x09- return true/false on integer compare
loadb   - load binary file over serial line (kermit mode)
loads   - load S-Record file over serial line
loop    - infinite loop on address range
memory bit operation :
Format : mbit <parameter>
md      - memory display
mii     - MII utility commands
mm      - memory modify (auto-incrementing)
mmcinit - init mmc card
mmcinit 0 -- init mmc device 0
mmcinit 1 -- init mmc device 1
mmcread - read data from SD/MMC card
<dev_id> <addr> <block_num> <bytes>
-read data from SD/MMC card block address 'block_num' on 'dev_id'
to memory address 'addr' size is 'bytes'
mmcwrite - write data to SD/MMC card
<dev_id> <addr> <block_num> <bytes>
-write data to SD/MMC card block address 'block_num' on 'dev_id'
from memory address 'addr' size is 'bytes'
mtest   - simple RAM test
mw      - memory write (fill)
nandrw  - NAND sub-system
nboot   - boot from NAND device
nfs\0x09- boot image via network using NFS protocol
nm      - memory modify (constant address)
ping\0x09- send ICMP ECHO_REQUEST to network host
printenv- print environment variables
protect - enable or disable FLASH write protection
rarpboot- boot image via network using RARP/TFTP protocol
reset   - Perform RESET of the CPU
run     - run commands in an environment variable
saveenv - save environment variables to persistent storage
sdwaitins - wait sd card inserted or removed
sdwaitins 0 -- waiting removed
sdwaitins 1 -- waiting inserted
setenv  - set environment variables
sleep   - delay execution for some time
test    - minimal test like /bin/sh
textout - show text to the screen
textout x y "str" color
color is 24bit Hex, R[23:16], G[15:8], B[7:0]
for example: textout 0 0 "hello world" FFFFFF
tftpboot- boot image via network using TFTP protocol
version - print monitor version

In un prossimo articolo descriverò alcuni di questi comandi che sono particolarmente utili per ricavare informazioni sul proprio tablet e per modificare alcuni parametri (variabili di ambiente) per correggere eventuali errori dovuti all’ installazione di rom non adeguate.

Home made tablet’s dongle

Yesterday I was in a supermarket for my normal needs for beer and chocolate (orange flavoured) and my attention was attracted by a big box with some “special offers” inside. It was full of old electronic devices like car chargers and wall power supply for cellphones. There was one for LG phones at 0.50 Euro ! I immediatly pick it up, thinking of use the 5V supply for some project or gadget of my own production.

When at home, I opened the plastic box (below you can see a picture of the label)

and cut the wire ; measuring the green and black wires my opinion was confirmed : 5.25V output and even if loading the wires with a low value resistor the power just decreased to 5.15V , so, now I have an efficient 5V wall power supply for 0,5 Euro.

But this isn’t the most important thing. Looking at the connector I just cut out from the wire (‘cause I don’t own an LG cellphone) I had a hearthbeat miss (just one eh)… the connector seemed VERY similar to the one (the 24 pin flat and small) that’s used in my tablet’s dongle (the one for expanding with 2 USB, LAN and pads for Serial Port). Look this picture:

Yes, is exactly the right connector ! Now, the problem is : for any normal use, I need at least for 4 pins, even for USB, even for LAN. In this days I’m using the LAN to connect my tablet to the PC to develop some applications, so will be VERY useful for me to have a supplemental dongle for my work. As you can see in the picture, the phone charger seems to have just 3 contacts, but isn’t true: the contacts are four ; the green wire is connected to 2 pins tied together as the black wire (but these pins are far and so more easy to see). Well, the 4 pins are placed, originally, in positions 4 and 5 for +5V (green wire) and 12 and 19 for GND (black wire). For my needs (the LAN connection) I must connect 7,8,10,12 pins, so only the 12 is at right place. The others must be moved. So you must extract, very carefully, from their original places and insert in the new ones. The pins are VERY small so you, probably will need for some “optical enhancement” ! After placing the pins in the right places, you can solder the wires, as shown in this picture :

After soldering the 4 wires, you can close the connector and use an appropriate LAN socket to do the rest of job. The final result will like as this :

The pinout for the connection is specific for the LAN. If you like to make a dongle, for example, useable for one USB keyboard, simply place the contacts in the positions of USB Vcc, D+, D- and GND (look at my Robotop’s Place on HcH / TK forum, in the section “Good quality schematics” and browse some tablet’s internals for the 24 pin connector pinout). Hope this will help someone to make his own tablet’s dongle, as I did. Please, note that most of tablets have a problem of thickness in the dongle insertion. The plastic thickness of the tablet’s border and the one of the dongle’s case, summed together, may give a unreliable electrical contact. The same is for this non-standard dongle. My solution, useful for both cases, was to reduce the tablet’s border thickness with generous use of a Dremel tool 🙂

Install Puppy Linux (on Alix-1D motherboard or other)

I am a typical Windows user, but in first months of 2011, I decided to switch to Linux. This page will be intended as a short report of my experiences in this job. Sometimes a little problem requires a huge amount of time to be solved, expecially if you don’t have the right tools. Switching to Linux can be, sometimes, a little bit frustrating, ‘cause your “usual” win instruments are still present, but in a different form or name. I hope the tips and tricks you can find here will be useful for shorting the “switching time” if you are doing the giant leap to the open source world.

The “Alix-1D” is a compact mini-ITX motherboard with VERY low power consumption, based on AMD Geode chipset ; infos about the board can be obtained at this link . The hard disk can be a normal IDE 2.5″ or a compact flash memory (there is an on-board connector) and the 256 MBytes RAM is mounted directly on the board. If you use a Compact Flash memory as main mass storage, the Puppy Linux is the best choice, ‘cause it can be set to run entirely in RAM ; the access to disk will be limited and the life of the Compact Flash memory may be long.

So, let’s start to install ; this is a step-by-step operations list using a Windows PC to create a Linux based Alix PC.

1) Get the Unetbootin program from the Internet at this link . This tool can install an ISO file on USB memory key and makes it BOOTABLE.
2) Get the Puppy Linux 4.2 retro ISO file from the Internet at this link  or the Puppy Linux 4.3.1 retro from this other link . Both versions are based on kernel k2.6.21.7 that runs fine on Geode chipset.
3) Also get the MD5 (checksum) file for the the 4.2 version from this link or the 4.3.1 version from this link . Both are text files, so they will probably open directly as text in your browser ; in this case, click on the right mouse button and choose “save target as” for download.
4) Get the HP DiskOnKey USB disk storage format tool from this link (or search an alternative on Google).
5) Get the HashTab program from this link . This program integrates the Windows shell and, after installing, you have a new feature on the mouse right click : you can compute the MD5 verification code for any file.

Well, you have, now, all that you need -as software- for starting the job ; please, install the HashTab and the HP Format tool programs ; the Unetbootin program doesn’t need to be installed, it is already executable.
As first operation, right click the downloaded ISO file to verify the MD5 check code. The HashTab has added to your ‘right click’ menus the MD5 computation tool, so copy the MD5 code from the *md5.txt file and paste in the verify box ; if the checksum is good, a green ‘V’ will appear, so the downloaded file is correct (see below).

Now, the hardware ; you just need for an USB memory key (at least 128 MBytes size) and, obviously, for a compact flash or a 2.5″ IDE hard disk to connect to the motherboard.
Let’s go with a Compact Flash memory, cause is “compact” and fits directly in the motherboard’s socket; a 512 MBytes or 1 GByte size will be enough for a small system.

1) Format your USB memory key with the HP tool, specifying the FAT file system ; the boot option isn’t needed (see below).

2) Start the Unetbootin program and select the Puppy Linux ISO file you just downloaded from the Internet ; wait for end of operations and not restart the Windows system now.

3) Remove the USB key from the Windows system and put it in the Alix board.
4) Turn ON the Alix board and go into the BIOS, Advanced Features, and select
the USB drive as the first boot device, then restart.
5) After a while, you can see on your screen a selection box for what option to start ; choose Puppy and go on.
6) You will be requested for mouse type (PS/2, USB or RS232), for keyboard layout and for video mode. Select the appropriate keyboard and language for you and Xvesa for video.
7) After a while the splash screen (and dog bark) will appear, at typical 800×600
screen size. Accept it or change (better) to 1024×768, 16 bit colors.

Now you have a fresh Puppy Linux Live OS working. You can play with it or start the installation on hard disk (the Compact Flash in this case).
Puppy Linux has very powerful install feature and many useful tools, all this in about 100 MBytes of ISO file !
Note that Puppy Linux is less “paranoic” than other Linux distros. This means that you start as superuser (root) and without any password. Naturally, you can set your own user and password if you really need them.
In the Alix-1D case, and generally in embedded applications, the need for a severe security feature is inexistent, so the “Puppy way” to operate is good and smart.

Go on installing OS onto the compact flash disk.

Now.. you’re running your Puppy Linux from USB memory key. It’s time to install to hard disk ; in this example we use a Transcend 512MB Compact Flash, rated for 80x access data speed (normally used for photo cameras).

1) From ‘menu’ select : System -> GParted partition manager ; this launches the disk partition program. From the disk selection choose the hda internal drive and click Ok. If the Compact Flash was never formatted before, probably there is a fat16 default space of about 500 Mb named as /dev/hda1. Click on the box (the contour becames dotted) then choose : Partition -> Delete ; confirm clicking on ‘apply’. Now there is only unallocated space. Click the box (as usual the contour becames dotted) and select : Partition -> New, then leave all fields as default (Primary Partition, ext2) and click ‘Add’, then confirm with ‘apply’. Now, close the partition manager.
2) From ‘menu’ select : Setup -> Puppy universal installer ; this starts the Puppy installation on the hard disk. Select Internal (IDE or SATA) hard drive as destination and confirm the following box with hda installed disk.
3) Click the small dog with ‘install Puppy to hda1:’, then OK. At this point the program asks for location of installation files. There is a selection with two buttons: CD and DIRECTORY ; your files are on USB key, so you must click on the desktop icon called ‘sda1’ (that looks like a usb memory key drive) to make it available (mounted). Note that Puppy likes a single click, not double, for many operations (it can be changed, obviously). Now the sda1 is mounted (a green dot appeared on it) and a window opens with the contents of /mnt/sda1 directory. Well, close that window and choose DIRECTORY for the install files location. The installer now shows a file selection dialog ; on the left panel, double click ‘../’, then ‘mnt/’, then ‘sda1/’ ; on the right panel, now, double click the initrd.gz file.
4) The installer asks now for selection for FRUGAL or FULL install; choose FULL and the installer will start copying files from the USB disk drive. This will require some minutes… so, please wait patiently (don’t do anything else on the system) until next box appears !
5) When the installer has finished to copy files, it asks for the GRUB installation. The GRUB is  the boot manager for the system ; it can boot your PC from external drive or will reside on  the MBR of your internal disk. In my opinion, this is the better way to use it on the Alix motherboard system, so click ‘install/update GRUB’, ignoring ‘Boot from USB’. Next box will ask for ‘UPDATE’ or ‘INSTALL’, choose ‘INSTALL’ and confirm with ‘OK’. Again a box, with ‘simple’ or ‘expert’ mode, choose ‘simple’ ( it’s simpler ! ) , then on next message choose ‘standard’. Next box asks for GRUB location ; leave it as is (/dev/hda1) and confirm clicking ‘OK’. The last selection, now : where the GRUB start sector has to be stored. Choose ‘MBR’ and click ‘OK’; click again OK on the next message box, leaving blank the text field.
6) If all is gone right, you can see now the GRUB INSTALL SUCCESS message ; click ‘OK’ and when the program goes to next message, proposing to redo the operation, click ‘NO’. Finished.
7) Verify, now, if the GRUB is OK. Single click on the desktop icon hda1 to mount it ; the contents of directory ‘/mnt/hda1’ is shown. Click on ‘boot’, then ‘grub’, then ‘menu.lst’. The ‘Geany’ text editor will open the grub menu file for editing. If you see a line with text ‘title Windows (on /dev/sda1)’, then you have a problem. The grub installer thinks you have a Windows OS installed on the HD and has set the option to boot that, not Puppy ; in this case, follow next steps to force the Puppy Linux booting :
a) remove all file lines (empty file)
b) write next lines :

timeout 3
title Puppy Linux (on /dev/hda1)
root (hd0,0)
kernel /boot/vmlinuz root=/dev/hda1 ro
title – For help press ‘c’, then type ‘help’
root (hd0)

c) save the modified menu.lst and close the editor
8) From ‘menu’, select : Shutdown, then click the shutdown button. The program asks for saving your options (mouse, keyboard etc..) but your answer will be ‘NO’. I suggest to do this way ‘cause you still have to set some option in the freshly installed Puppy.
9) Your Alix PC is now turned OFF ; remove the usb key and power-on it again.

Your Puppy Linux will start and run from the Compact Flash drive. You will be asked again for mouse, keyboard and video, but this is the last time.
Note that you have over 188 MBytes free for your programs on the 512 MBytes CompactFlash disk !

Enjoy Puppy Linux !

Get serial data from USB GPS receiver

Some years ago, I purchased a “GPS mouse”, a device that has magnetic base and connects to PC USB port to give GPS position to navigation program. I remember I purchased, also, a true licensed copy of Microsoft’s Autoroute 2005 program. This means I’m speaking about a device at least 7 years old…

Recently, I reloaded the software on a very old notebook that is normally hidden under the seat in my car ; it is just for emergency situations (I am able to lost even in a well known regions).

Good, having tried a new route and noticed that the way was every minute much harder, and forced to admit that it terminates on the gate of a haunted house, I tried to make a position search using the GPS receiver with the notebook.

But there was a problem… the device, when connected to the notebook, makes it turning off ! It was like a short circuit on USB connector. So, no position, no help, no GPS. I did my route backside until recognized a known road…

Ok, when at home, I decided to open the GPS receiver to look inside and indagate on the reason of such short circuit. The receiver model is BU-303 and has 2 hidden screws under a rubber plate that covers the magnet (I never attached the device on my car’s top, ‘cause it was originally good to connect satellites even if used inside the car). So, after removing the rubber plate and the screws, I opened the box. Oh, there is a very small battery inside, probably to retain some satellites data when powered off. This small battery was rated for 3.3Volts… Hmmm, using my multimeter to measure the residual charge, I read exactly ZERO volt. The battery is gone. Ok, it was directly  soldered on the circuit and I removed it easily. Now, connecting the USB to a notebook, all worked fine.

I decided to look inside and discovered, after removing a metallic shield, one unused option. As you can see in the picture below, the device can have USB or RS-232 connection !!! The unmounted IC seems (looking at the connections) very similar to one classic MAX232 or equivalent.

Connecting an oscilloscope and measuring the most probable pins, I discovered that the serial output was present on pin 11 of the missing IC, with amplitude of about 3V and protocol 4800,N,8,1. Also it was evident that with a small wire to connect one pad to the very near opposite, that signal can be “routed” to an easy point of the circuit to solder on, so the shield could be soldered again in its place. So I soldered a very small wire to the contacts as in figure :

The yellow dots are the points connected together. It was not easy… But at the end I mounted again the metallic shield on, and soldered 3 wires to make power and serial connections as in the final picture here :

Now, the circuit can be powered from 5V ( also tested and working at 3.3V ) and on the wire S-out you can get (at TTL level, around 3V) the various NMEA sentences that can be read, for example, from a microcontroller to make a satellite localization system, adding a GSM phone module to send you the actual position of your car via sms.

I also tried to connect the circuit to the debug port ( ttyS0 ) of a cheap Android tablet, but unfortunately the ttyS0, when forced by software commands to run at 4800 BPS, on such hardware (WM8650 based) can’t set the right baud rate and “shifts” automatically to 9600, that obviously isn’t useful for this work.

Anyway, I hope this will be useful for someone….